-2

I am trying to do some experimenting with certain system files (DLLs, EXEs) in Windows and would like to know how I can get information about the functions that they contain. I want to be able to call some of them just as if Windows does. How could one do this?

I guess I would need to know what the function names are, and how to call the functions by their names, and what parameters to pass.

  • 1
    Get the functions? That is, the function names, their relative addresses, their addresses after being loaded into a process, the arguments they require? It's unclear what you are asking. – 0xC0000022L Oct 17 '13 at 21:13
8

TL;DR you can call anything, locating the right part of code is the hard part.

export table

If you mean 'just as Windows does', then you mean the functions of the DLL that are available to the others, ie the exported ones? in this case, you need to parse the export table - check pefile for a readable and reliable implementation.

locating any function

IDA

If you actually mean 'all the functions, including the internal ones', then you need to disassemble and tell the difference from code and data. in this case, your best bet is to open the files in IDA - with symbols preferrably - and export the function list.

manually

If you want to do that manually, then you need your own smart disassembler, which is far from trivial: sometimes, compilers generate some code that doesn't immediately look like parts of a function.

calling identified functions

Once you've located the functions, you can just call them directly, without the need of injection, but you have to make sure you have the exact same version of the DLL. hard_imports use such a method to call pieces of code directly.

  • Good answer, but: can you actually call functions externally that are not exported? The usual function, GetProcAddress, needs either an exported name or ordinal value. – usr2564301 Oct 17 '13 at 23:09
  • I am geussing if they are not exported than you would need to inject into the process. – user1632018 Oct 18 '13 at 1:22
  • BTW thanks Ange. That helped. I did mean the exported functions. I actually originally had that in the description then decided to change it thinking others would know what I am talking about. – user1632018 Oct 18 '13 at 1:23

Not the answer you're looking for? Browse other questions tagged or ask your own question.